CVE-2025-10284: Improper Archive Extraction in unarchive Enables RCE

Severity: critical (CVSS 9.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-10-09 · updated 2026-10-08
Weakness: CWE-22

Description

BBOT's unarchive module could be abused by supplying malicious archives files and when extracted can then perform an arbitrary file write, resulting in remote code execution.

Affected products

BLSOPS, LLC bbot: through 2.6.1

References

https://blog.blacklanternsecurity.com/p/bbot-security-advisory-gitdumper

Get alerted when CVE-2025-10284 or the next vulnerability affects your stack